Network & Infrastructure / DNS, DNSSEC & Service Discovery
DNSSEC key rollover and overlapping cache lifetimes
A key rollover works for fresh resolvers but fails for resolvers carrying older key or DS data. The rollout sequence may have ignored previously cached dependencies.
Environment and inputs: Authoritative and recursive DNS infrastructure; BIND examples are conceptual and require release-matched configuration. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Inventory DNSKEY, DS and signature lifetimes, publication stages and the signing tool's rollover state. Determine which old and new combinations validators can encounter during the transition.
Explain the result
Validators can combine data obtained at different times. A rollover must maintain a valid chain across those plausible cache states, not only in a freshly flushed test resolver.
Plan the fix
Use the signing platform's supported staged rollover workflow and allow required propagation intervals. Treat manual key deletion as a potentially disruptive action requiring complete state knowledge.
Check the result and rollback
Test both warm-cache and fresh-cache validation at each stage. Halt the rollover and retain the still-valid key material if any expected cache combination loses its validation chain.